WordPress Plugin Vulnerabilities

WooCommerce Box Office < 1.1.52 - Unauthenticated Ticket Barcode Update

Description

The plugin does not have authorisation and CSRF when updating a ticket bar-code, allowing unauthenticated users to perform such action

Proof of Concept

Affects Plugins

Plugin icon
woocommerce-box-office
Fixed in 1.1.52

References

CVE
CVE-2023-34003
URL
https://patchstack.com/database/vulnerability/woocommerce-box-office/wordpress-woocommerce-box-office-plugin-1-1-51-unauthenticated-save-ticket-barcode-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
Yes
WPVDB ID
368897ab-72b8-4ffc-adc6-b5970be2aba6

Timeline

Publicly Published
2023-06-02 (about 2 years ago)
Added
2023-06-21 (about 2 years ago)
Last Updated
2023-06-21 (about 2 years ago)

Other

Published
Title
Published
2026-01-06
Title
Piraeus Bank WooCommerce Payment Gateway < 3.1.5 - Missing Authorization to Unauthenticated Arbitrary Order Status Change
Published
2025-01-24
Title
WP Fast Total Search < 1.79.262 - Missing Authorization
Published
2024-07-19
Title
Getwid – Gutenberg Blocks < 2.0.11 - Missing Authentication to MailChimp API key update
Published
2025-09-03
Title
SaasLauncher < 1.3.1 - Missing Authorization
Published
2025-08-14
Title
WPGuppy < 1.1.5 - Missing Authorization